feat(shard): resolve from-commit and from-pr lines against their trees

.github/workflows/ci_test.yml

@@ -32,6 +32,16 @@ jobs:
       - name: Cargo source package
         run: cargo package --locked
 
+  ledger:
+    name: ledger proofs and writer exclusion
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Records, proofs, and POSIX writer locks
+        run: cargo test --locked --test ledger --test ledger_posix_lock --test ledger_lock_aliases --test ledger_retry --test ledger_durability
+
   msrv:
     name: Rust 1.88 minimum
     runs-on: ubuntu-latest
@@ -88,6 +98,7 @@ jobs:
             --test eon_foss_2026_1 \
             --test qmcpack_foss_2026_1 \
             --test eon_packaging \
+            --test bundle_component_checksums \
             --test goal_scenario \
             -- --nocapture
 

.gitignore

@@ -17,9 +17,9 @@ target
 # rustc ICE dumps
 rustc-ice-*.txt
 
-# Machine-local agent configuration
-.claude/
-.codex/
+# Hidden working directories are private; repository CI remains visible.
+.*/
+!/.github/
 
 # Sphinx build (docs/orgmode/*.org is the source of truth; docs/source/*.rst
 # and graphviz SVGs under docs/orgmode/images are regenerated by

AGENTS.md

@@ -77,6 +77,7 @@ stack    solve | sbom | order | easystack | sections | from-commit | gap | provi
 target   list | doctor
 campaign run | status | finding claim | finding resolve
 repro    summary
+ledger   append | head | show | verify
 easyblock-reach
 pr-overlap
 rebuild-set
@@ -86,7 +87,7 @@ mcp
 
 The Model Context Protocol (MCP) catalog mirrors these commands,
 including pr-overlap, rebuild-set, component-reach, easyblock-reach,
-and repro summary, with `eb_`-prefixed tools. Recipe file tools
+repro summary, and the ledger commands, with `eb_`-prefixed tools. Recipe file tools
 (`eb_recipe_read`, `eb_recipe_list`, `eb_recipe_edit`,
 `eb_recipe_apply_suggestion`, `eb_recipe_diff`, `eb_recipe_write`,
 `eb_recipe_grep`, and `eb_dep_versions`), easyblock dry-run, module

CHANGELOG.md

@@ -15,6 +15,22 @@ All notable changes to this project are documented here.
 
 ### Fixed
 
+- `stack shard` resolves a build-list line with `--from-commit` or
+  `--from-pr` against that commit's or pull request's easyconfigs first,
+  then the robot path, the order EasyBuild uses. A dependency such a line
+  shares with another shard goes to the prelude, so two shards do not
+  build it at once. `petsc4py-3.25.0-foss-2026.1.eb --from-commit=...`
+  and the `PETSc-3.25.0-foss-2026.1.eb` line it needs plan into one
+  shard, PETSc first. Split over two shards, the second build stops on
+  PETSc's install lock. A prelude line for a module only a
+  fetched tree provides carries that line's `--from-commit`,
+  `--from-pr` and `--include-easyblocks-from-*` options. A fetched line
+  that still cannot be resolved stays opaque; `plan.json` gives the cause
+  under `opaque_reason` and the top-level `opaque`, and the command
+  prints a `warning:` line for it and `opaque=<n>` in its summary.
+  A `--commit-cache` download that fails before an HTTP status exits 1
+  and writes nothing; the error names the cache, the commit, the URL,
+  and the transport error. An HTTP status, including 404, stays opaque.
 - `stack shard` plans a build-list line it cannot resolve as an opaque
   line when EasyBuild can still build it: the line carries `--from-pr`
   or `--from-commit`, or its easyconfig is on the robot path but does
@@ -44,6 +60,27 @@ All notable changes to this project are documented here.
 
 ### Added
 
+- `stack shard --commit-cache DIR` reads the trees of `--from-commit` and
+  `--from-pr` lines from DIR and downloads the missing ones: a commit from
+  `codeload.github.com/easybuilders/easybuild-easyconfigs` (its `.eb`
+  files only), a pull request's changed easyconfigs at its head from
+  `api.github.com`. `--commit-tree COMMIT=DIR` and `--pr-tree N=DIR` name
+  trees already on disk. `eb_stack_shard` takes `commit_cache`,
+  `commit_tree` and `pr_tree`.
+- `ledger append`, `ledger head`, `ledger show`, and `ledger verify` keep
+  a per-stack software ledger: one JSON Lines file of install, rebuild,
+  retire, move, access, removal, finding, and correction records. Each
+  line is canonical JSON (keys sorted, no whitespace, integers only) with
+  its `index` and `id` filled in, and its leaf is the RFC 9162 leaf hash
+  of the line, from the `rfc9162` crate. Heads are signed with Ed25519
+  under the domain `eb-stack-ledger-v1`; the key is a PEM path passed on
+  the command line and is refused inside the log's directory.
+  `ledger verify --record N --head HEAD` checks an inclusion proof and
+  `ledger verify --from HEAD1 --to HEAD2` a consistency proof, so a
+  removed record or a rewritten log is status 1. `eb_ledger_append`,
+  `eb_ledger_head`, `eb_ledger_show`, and `eb_ledger_verify` are the same
+  commands over MCP.
+
 - `stack order --installed` stops the build order at modules already on
   the machine. A file is a module listing and a directory is an Lmod
   tree, read the same way as `stack gap --installed`. The version is the

CONTRIBUTING.md

@@ -66,7 +66,7 @@ Do not hand-edit generated `docs/source/**/*.rst` or `docs/source/crates/`.
 
 ## Packaging campaigns
 
-Follow `AGENTS.md`, `skills/annual-bump/SKILL.md` (generation rebuild), and
+Follow `skills/annual-bump/SKILL.md` (generation rebuild) and
 `skills/new-package/SKILL.md` (conda-forge/Spack: new EasyBuild recipe). Run
 `skills/verify-recipe/SKILL.md` over what they emit before a build or a push,
 and `skills/tool-repair/SKILL.md` when the emitted file needed a hand